21
votes
Accepted
How does NAT reflection (NAT loopback) work?
For a NAT to work properly both the packets from client to server and the packets from server to client must pass through the NAT.
Note that the NAT table in iptables is only used for the first ...
- 3,920
10
votes
Accepted
GlusterFS how to failover (smartly) if a mounted Server is failed?
When you are doing this:
mount -t glusterfs gluster-server-01:/volume-www /var/www
You are initially connecting to one of the nodes that make up the Gluster volume, but the Gluster Native Client (...
- 216
7
votes
"ssh -L <port>" only working from local machine
Try ssh -g -L ...
From man ssh:
-g
Allows remote hosts to connect to local forwarded ports. If used on a multiplexed connection, then this option must be specified on the master process.
...
- 53.7k
6
votes
Accepted
Port forwarding & NAT with nftables
You are not translating the port number. When the external connection is to port 1234, this is not a problem. But when it is to 4321, the dnat passes through to port 4321 on the internal server, not ...
- 211
5
votes
Send traffic to self over physical network on Ubuntu
Create a network namespace and move one of interfaces into it:
ip netns add test
ip link set eth1 netns test
Start a shell in the new namespace:
ip netns exec test bash
Then proceed as if you had ...
- 350
5
votes
5
votes
Linux: Connect to two different networks with same ip range
Firstly, I don't have the option to test this really, so I'm bound to have some detail wrong, but essentially you'll need special routing to make some packets for address 10.5.5.9 to go out wlan1 and ...
- 3,123
5
votes
Accepted
Access VM via static IP (NAT?)
You've to create a bridged network between the Host and VM. The configuration varies on Hypervisor vendor.
In case you're using Oracle Virtual Box
Open Oracle VM VirtualBox Manager, select the VM ...
- 2,030
4
votes
Accepted
Randomize external port when doing NAT with iptables
SNAT accepts a --random option (from iptables-extensions manpage):
--random
If option --random is used then port mapping will be randomized
(kernel >= 2.6.21).
So I'd try something ...
- 5,600
4
votes
Temporary redirect ports
You need at least
iptables -I FORWARD 0 -d 192.168.77.4 -p tcp --dport 80 -j ACCEPT
With -I FORWARD 0 you insert your own rule before the shorewall firewall rules
which have a generic reject rule in ...
- 25.4k
4
votes
Routing internet on NAT server thru Squid proxy
To transparently intercept traffic use policy based routing via NAT to redirect the web traffic to the squid proxy, then intercept it.
Set policy routing on your GW or NAT box, adjust the ip's and ...
- 8,300
4
votes
Accepted
Does NAT allow accessing internal network (or router's local interface) from outisde by default?
That's normal, and has nothing to do with NAT. Linux, by default, treats IP addresses as belonging to the machine¹, not to a particular interface. So it'll answer packets to 192.168.2.1 on any ...
- 102k
4
votes
Accepted
ssh connection refused from same PC when going outside local network
You won't be able to connect to the NAT'ed server name from the host which is the destination of the NAT. The reason is very simple NAT breaks TCP/IP in this case. Just walk through what's happening ...
- 851
4
votes
SSH connections frequently disconnected when using a mobile hotspot for internet access
There are three main reasons your ssh sessions (or other persistent connections) may be disrupted when using cellphone towers/a mobile hotspot for internet access:
Your IP address is changing. This ...
- 161
4
votes
Can a NAT router run out of ports?
If a router doing NAT uses an ephemeral port for each connection made to the internet on behalf of the hosts on the internal network, does this mean that it is possible for the router to run out of ...
- 90.4k
3
votes
Accepted
NAT box with multiple internal and external interfaces
OK, I figured it out. What I had to do was add the internal subnet route to each route table then set rules to control what interface traffic routes to/from. Then in iptables marking packets with ...
- 61
3
votes
Accepted
How to configure QoS per IP basis?
You need to pick a class aware qdisc like HFSC or HTB.
Then you'll have to build a class tree like this:
Root Class (10MBit)
|
\--- XyZ Class (rate 3Mbit ceil 3Mbit)
| |
| \--- Client 10 (rate ...
- 42.5k
3
votes
GlusterFS how to failover (smartly) if a mounted Server is failed?
OpenUserX03's answer is not quite accurate.
When a client connects to a Gluster server node, it receives information about all the nodes. After that, it starts communicating with multiple nodes ...
- 131
3
votes
How does iptables MASQUERADE work on the incoming side?
In iptables only the first packet of a connection hits the chains in the nat table (this is different from chains in other tables). Packets related to an existing connection are translated ...
- 3,920
3
votes
Accepted
Enable ssh host to guest & guest Internet on CentOS 7 guest with VirtualBox
So I finally got it to work
I was missing netmask value in the configuration
Host only NIC enp0s3
TYPE=Ethernet
BOOTPROTO=static
NAME=enp0s3
UUID=71d4200e-199d-4d03-935d-6d2e88c41956
DEVICE=enp0s3
...
- 151
3
votes
Networking issue with Virtualbox
Network connectivity to your VM - assuming of course that it has a properly configured service to connect to - depends on what network type you've chosen in the VM settings.
1) NAT - this does what ...
- 4,700
3
votes
iptables/netfilter: "nf_nat_ftp" is not working well with recent Linux kernels
I already answered it at superuser.com
Basically newer kernels ( >= 4.7 ) are deprecating the automatic helper module's port assignment in favor of explicit rules.
Short fix to get the old behaviour:...
- 25.1k
3
votes
Using Linux as router with nftables - masquerade not forwarding reply back
The nftables wiki states:
"[...] you have to register the prerouting/postrouting chains even if you have no rules there since these chain will invoke the NAT engine for the packets coming in the ...
- 31
3
votes
Accepted
How To Configure a noip on linux, if I has Double NAT ISP Like JioFi?
Your ISP does NAT between its public IP (157.50.xx.xx) and the ISP internal private IP (10.89.xx.xx). Unless you can convince your ISP (by switching to the appropriate plan, usually for business, that ...
- 29.1k
3
votes
Accepted
Iptables NAT / Kernel IP forwarding limited to ~10Mbit
The Banana R1/Lamobo R1 while an interesting piece of hardware has too many shortcomings.
Firstly, the "switch" internal interface bandwidth is shared. A theoretical 1GBps tops for all shared 5 ports;...
- 53.4k
3
votes
How can I access a virtual machine running on a remote machine directly?
Use ProxyJump or ProxyCommand.
Add this to your ~/.ssh/config:
Host vmhost
User t
Hostname 192.168.1.198
Host vm
Hostname 192.168.122.169
User t
ProxyJump vmhost
or for older ...
- 20.7k
3
votes
Accepted
nat configuration for qemu-kvm guest and host networks
The MASQUERADE rule happens at POSTROUTING: that is after a routing decision was already made and a destination interface was already chosen. To communicate with outside, the host will use 192.168.117....
- 25.1k
3
votes
Accepted
How to share an IPv6 connection to the whole LAN?
Sure, if your IPv6 connection gives you a prefix that is large enough for all the devices in the LAN (i.e. a prefix number smaller than /128, ideally /64 or less).
First, enable IPv6 forwarding by ...
- 68.6k
3
votes
Accepted
iptables rules to forward tftp via NAT
Since Linux 4.7 in 2016, the conntrack automatic helper assignment was disabled by default (after having years of warning about this in kernel messages):
Four years ago we introduced a new sysctl ...
- 25.1k
Only top scored, non community-wiki answers of a minimum length are eligible